What OpenCTI costs to run and who should model it
The Community Edition has no license fee, but the cost of ownership is set by the features you need and the infrastructure you run. OpenCTI Community Edition is licensed under the Apache License 2.0. Features that the Enterprise Edition documentation lists, including SSO configuration, activity monitoring and audit logs, playbooks, organization-based data segregation, authorized members, full-text document indexing, AI features and priority intelligence requirements, require a commercial license from Filigran. Since OpenCTI 7.260224.0, defining and using authentication strategies, including SSO, is an Enterprise Edition feature. Confirm with Filigran which features your access model depends on before you assume the Community Edition covers it.
LTS releases are a separate licensing question. They are distributed as container images but need a specific LTS license key, so confirm the key terms, renewal and what it covers before you commit to the LTS line in your model. Also confirm whether Enterprise Edition is delivered on premises or as SaaS, since that changes who operates the platform and the cost lines around it.
The recurring infrastructure cost sits in the dependencies, not the license. Elasticsearch or OpenSearch, Redis, RabbitMQ, S3-compatible object storage such as MinIO, the platform nodes and the Python workers all run in your environment, and each needs capacity, backups, patching and monitoring. Use the documented minimums as a starting point, then ask for sizing that reflects your data volume and connector count.
What the cost assessment covers and delivers
The assessment turns edition, release and infrastructure choices into a costed model your finance, security and platform teams can review. It stops short of quoting or promising a price.
Feature-to-edition mapping
Each requirement on your list is matched to either Community Edition behavior or an Enterprise Edition capability, such as SSO configuration, activity monitoring and audit logs, playbooks, organization-based data segregation and full-text document indexing. Requirements with no clear match are flagged for confirmation with Filigran before any edition decision is recorded.
Release cadence as a cost input
The assessment documents whether you run continuous releases or the licensed LTS line, since LTS builds need a specific license key and receive only critical bug and security fixes after stabilization. It also records how often your team would need to test and upgrade connectors and data under each choice.
Dependency footprint sizing
Documented minimums for the platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage are translated into node counts and capacity for your expected data volume and connector count. The sizing states which numbers come from Filigran's documentation and which are assumptions you must validate in your own environment.
Recurring infrastructure and staff time
Recurring costs are split into cloud or data center capacity for the platform, workers, search, queues and storage, plus analyst and platform engineer hours for upgrades, connector maintenance and monitoring. Each line shows who pays for it, what drives it up, and how often it recurs.
Enterprise licensing options review
Enterprise deployment on premises or as SaaS, trial licenses and free license eligibility are compared against the requirement list and your hosting constraints. The review lists the licensing questions that remain open, such as term, scope and renewal, so they can be answered in writing before budgeting.
Written TCO model with assumptions
The total cost model sets out every input, its source and its owner, so each figure can be challenged and updated. Assumptions for volumes, release cadence and staffing are kept separate from supplied facts, making it clear which numbers would change if your scope or connector list changes.
Edition decision record and quote questions
The edition decision record captures the chosen edition, the requirements that drove it, and the risks you accepted. The accompanying quote question list gives Filigran or a reseller a precise set of items to price, including license scope, support terms and what each option excludes.
What drives OpenCTI running cost up or down
This table lists the main OpenCTI cost drivers, why each one moves cost, and how to keep it under control.
| Driver | Why it moves cost | How to keep it down |
|---|---|---|
| Edition scope | SSO, audit logs, playbooks and organization segregation are Enterprise Edition features, so each one adds licensing scope. | List required features before requesting a quote, and confirm current licensing terms with Filigran. |
| Platform nodes and workers | Platform nodes and Python workers scale separately; documented guidance is one platform node for every 3 workers. | Start near documented minimums and add workers when RabbitMQ queues show sustained backlog. |
| Search cluster and storage | Elasticsearch or OpenSearch holds the indexed graph and grows with ingested data, so storage and memory scale together. | Set retention and deduplicate feeds early, and size the cluster from measured index growth. |
| Connector count and data volume | Each connector adds import jobs and workers, and enrichment connectors multiply writes into the search index. | Enable connectors one at a time, scope feeds to your sectors and track volume per connector. |
| Number of environments | Production, staging and development each need full dependency stacks, so every environment repeats platform, search, Redis, RabbitMQ and storage costs. | Use smaller staging sizing, and confirm which development license terms Filigran offers. |
| Authentication and audit requirements | SSO, audit logs and activity monitoring are Enterprise features, and retention and access reviews add ongoing operational work. | Map groups from your identity provider once, and reuse existing SSO and logging stacks where possible. |
| LTS versus continuous release cadence | LTS lines need a specific license key and receive only critical and security fixes after stabilization, while regular releases ship often. | Pick LTS for slower change control, and budget test cycles for each upgrade, whichever line you run. |
| Analyst headcount and workflow complexity | Analyst time, playbooks, custom dashboards and manual enrichment each add recurring effort. | Automate repeat enrichment through connectors, and keep workflows few, documented and owned. |
How the cost model is built
The sequence turns an OpenCTI plan into a recurring cost estimate that separates what is licensed, what is run, and what depends on your growth.
Inventory requirements and map them to editions
Your team lists the capabilities it needs, such as SSO, audit logs, playbooks, organization-based data segregation and AI features, and marks each one against the Community Edition or Enterprise Edition. The output is a requirement inventory that shows which costs depend on the license tier, and which stakeholders signed off on each item.
Establish the architecture baseline
The team records the platform, worker, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage components, using the documented dependencies and minimum sizing as the starting point. The output is a baseline diagram with the node counts, hosting model and the infrastructure each component needs in your environment.
Set workload assumptions for data, connectors and users
Your team estimates the data volume, the connectors that will run, the number of workers they need and the number of named users and groups. Connector and data inventories are usually the slowest inputs to gather. The output is a written assumptions sheet that every later figure traces back to.
Build the recurring cost model
Infrastructure, licenses and staff time are costed separately, with each line marked as one-time or recurring and tied to its driver, such as worker count or retention. Staff time covers platform operation, connector upkeep and analyst work on intelligence. The output is a recurring cost table with a named owner and quote basis for each line.
Run a sensitivity review for growth scenarios
The team recalculates the model for larger data volumes, more connectors, more users and a move between LTS and continuous releases. The review shows which assumptions move the total most. The output is a short set of scenarios with the cost changes and the assumptions to recheck at each review.
Write the decision record and quote questions
The team records the chosen edition, the assumptions behind it and the open questions for vendors and partners, such as license terms, LTS key handling and support scope. The output is a decision record that stakeholders approve and a list of questions to put in writing before any quote is accepted.
Recurring costs after go-live
This table lists the cost components that continue after an OpenCTI deployment goes live, showing whether each is one-time or recurring, who pays for it, and what to request in a quote.
| Cost component | One-time or recurring | Who pays | What to request in a quote |
|---|---|---|---|
| Enterprise Edition license (on premises or SaaS) | Recurring, usually annual term | Client, paid to Filigran or a reseller | License scope, term length, renewal terms, and whether SaaS hosting, support and upgrades are included |
| LTS license key for the stabilized line | Recurring if sold separately from the subscription | Client, paid to Filigran | Whether the LTS key is bundled with the Enterprise subscription, which LTS lines it covers, and renewal timing |
| Compute for platform, workers and connectors | Recurring | Client, to the cloud provider or data center owner | Node counts and sizes against the documented minimums, worker-to-platform ratio, and connector load assumptions |
| Elasticsearch or OpenSearch | Recurring, grows with data volume | Client, to the infrastructure owner or managed service provider | Node count, memory, SSD capacity, replica settings and growth assumptions for indexed intelligence |
| Redis, RabbitMQ and S3-compatible storage such as MinIO | Recurring, storage grows with files and queued messages | Client, to the infrastructure owner or managed service provider | Supported versions, high availability design, object storage capacity and retention assumptions |
| Backup storage and monitoring | Recurring, plus one-time setup | Client, to the infrastructure owner and monitoring tool vendor | Backup retention period, restore test frequency, monitoring tool licensing and alert coverage for each dependency |
| Staff time for platform administration | Recurring internal effort | Client, through internal salaries or contractor fees | Named owner, expected hours for upgrades, dependency patching and connector maintenance, and on-call coverage |
| Analyst time for ingestion and curation | Recurring internal effort | Client, through internal salaries or contracted analysts | Expected sources to review, curation workflow, deduplication effort and who approves new data entry |
| External support retainer | Recurring, optional | Client, paid to DeployOpen or another support provider | Covered components, response expectations, upgrade and testing services, and what is billed separately |
How the cost picture changes by starting point
Community Edition is licensed under Apache License 2.0, so the software carries no license fee. The cost sits in the work around it. Authentication strategies, including SSO, are an Enterprise Edition feature from 7.260224.0, so your team must provide another sign-in route.
- Identity: plan and build a sign-in route through an identity provider your organization already runs, and confirm which authentication options remain available in the edition you run.
- Accountability: without Enterprise audit logs and activity monitoring, budget for logging and retention in your own stack.
- Infrastructure: platform nodes, workers, Elasticsearch or OpenSearch, Redis, RabbitMQ and object storage remain yours to run, patch and back up.
- Upgrades: your team owns the release cadence and the testing against connectors and data.
Moving an existing install to Enterprise is mainly a licensing and configuration change on infrastructure you already run. You need an Enterprise Edition license from Filigran before enabling Enterprise features, and an LTS license key if you choose the LTS line. Plan the change as a staged project, not a single switch.
- License: request the Enterprise terms and key, and ask whether a trial period applies before a paid term starts.
- SSO: move authentication strategies into the Enterprise configuration, test group mapping, and keep the old route available until sign-in is verified.
- Features: review playbooks, organization-based segregation, authorized members and AI features. Each one may add work in access design and analyst training.
- Version: confirm the minimum version for each feature, since SSO requires 7.260224.0 or later.
Filigran offers free licenses for development, research and non-governmental organizations, and trial licenses for evaluation. Filigran decides eligibility, so do not plan a budget around a free license until it is confirmed in writing. Your cost depends on which category applies and what the license covers.
- Development: ask whether the license covers test environments only or staging and other pre-production use.
- Research: confirm the permitted use, the data types you may hold, and whether sharing results with commercial partners affects eligibility.
- Non-governmental organizations: confirm whether your organization type qualifies and what evidence Filigran requires.
- Infrastructure still applies: a free license leaves hosting, storage, backup, monitoring and analyst time as your costs.
Filigran offers Enterprise Edition on premises or as SaaS. SaaS moves platform hosting and dependency operations to the vendor, while on-premises keeps them in your environment, run by your staff or a partner. Compare the total effort and cost of each model, not only the license line.
- On-premises: you pay for compute, storage, search, queue and cache services, plus monitoring, backup and the work of each upgrade.
- SaaS: ask what the subscription includes, such as hosting, upgrades, backups, support hours and recovery commitments.
- Data location: confirm where threat data is stored and who can access it, since this may decide the model for regulated teams.
- Connectors: confirm which connectors run inside your network and how they reach a SaaS platform.
In restricted networks, the cost shifts toward dependency hosting and update delivery. Container images, packages and connector sources must reach the network through an approved transfer path, and LTS releases require the license key in that environment. Plan extra time for each release cycle.
- Dependency mirrors: plan internal copies of container images and packages for the platform, search, cache, queue and object storage services.
- Update delivery: ask Filigran how releases, LTS hotfixes and license renewals reach offline systems, and how often they arrive.
- Connectors: budget for vetting and mirroring each connector and its feed sources, since outbound feeds may be blocked.
- Support model: confirm what remote support is permitted and whether on-site staff must apply updates.
Where OpenCTI cost estimates usually go wrong
These six gaps most often make an OpenCTI estimate too low. Each one has a check you can make before the quote is signed.
Assuming Community covers SSO
Community Edition is licensed under Apache 2.0, but since 7.260224.0, defining and using authentication strategies, including SSO, is an Enterprise Edition feature. Audit logging and activity monitoring are also Enterprise features. Check each access requirement against the Enterprise feature list, and budget for an Enterprise license before the estimate is final.
Search cluster growth from connectors
Elasticsearch or OpenSearch holds the indexed intelligence, so every connector that imports feeds or enrichment adds data and query load. Estimates that size the cluster once, at launch volume, tend to understate later needs. Model expected connector volume over time, and ask for node count, memory and SSD sizing against the documented minimums and your growth projection.
LTS treated as a free upgrade
LTS releases are distributed as container images but require a specific LTS license key. After a one-month stabilization period, each LTS line receives only critical bug and security fixes, and a new LTS line arrives every six months. Budget for the key, the test cycle for connectors and data, and the work to move between LTS lines during each year of support.
Analyst triage and deduplication time
Connectors import overlapping indicators, reports and entities, so analysts spend recurring hours reviewing duplicates, confirming relationships and discarding noisy data. This labor continues every week after launch and can exceed infrastructure cost. Estimate triage hours per source, the deduplication rules you will maintain, and who owns data quality after go-live.
Non-production environments left out
Staging and test instances are needed to validate connector changes, platform upgrades and LTS key rollouts before production. Each one repeats the platform, search, queue, storage and identity components, and each needs administration time and backups. Ask the quote to list every non-production environment, the data it holds and whether its dependencies are sized like production.
Backup storage left out of the model
OpenCTI depends on S3-compatible object storage, the search cluster, Redis and RabbitMQ, and recovery requires those components to be backed up together. Backup copies consume storage that grows with retained data, and restore testing takes time. Ask for the backup scope, retention period, storage location and restore test steps in the quote.
What your team needs to provide
A quote for OpenCTI Enterprise Edition is only as accurate as the written requirements behind it, so your team should prepare these inputs before asking Filigran or an authorized channel for pricing. Start with a feature requirement list that names each capability you need, such as SSO, activity monitoring and audit logs, playbooks, organization-based data segregation, full-text document indexing, or priority intelligence requirements, and assign an owner to each item. Enterprise features are the main driver of edition choice, so an unowned requirement is usually one that gets added late.
Next, list the connectors you plan to run now and in the next budget cycle, including MITRE ATT&CK, MISP, feeds and enrichment services. For each one, estimate the expected data volume and import frequency. Your team should also state how many analysts and administrators will use the platform, since analyst headcount shapes user licensing and training effort, and administrator headcount shapes the operating model. Confirm these figures with the people who will run the connectors rather than relying on a single estimate.
Document hosting constraints as well. Identify the cloud accounts, data centers or air-gapped networks where OpenCTI and its dependencies (Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage) must run, the target environments such as development, test and production, and the existing identity provider and audit requirements that SSO and logging must meet. Name a single decision owner for edition and release cadence choices, since choosing between continuous releases and the LTS line affects licensing, upgrade testing and support scope. Ask the vendor to confirm what each license covers in writing.
Questions buyers ask about OpenCTI cost
Is OpenCTI Community Edition free to run in production?
The Community Edition is licensed under the Apache License 2.0, so the software itself carries no license fee. You still pay for the infrastructure that runs it: platform nodes, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible object storage. The documented minimums size these in cores, RAM and SSD. You also pay people to install, patch, back up and tune the platform, and analysts spend time on connectors and data quality. Ask any partner to show software licensing, hosting, staffing and support as separate lines in the quote.
Which OpenCTI features require the Enterprise Edition license?
The Enterprise Edition is proprietary and adds activity monitoring and audit logs, playbooks, organization-based data segregation, authorized members, full-text document indexing, AI features, priority intelligence requirements and SSO configuration. Since OpenCTI 7.260224.0, defining and using authentication strategies, including SSO, is an Enterprise Edition feature. Confirm the current edition boundary with Filigran before you finalize scope, because the feature split is set by the vendor and can change between releases.
How long does an OpenCTI cost model take to produce?
No duration is fixed by a supplied source, so confirm any timeline in writing with the partner or your own team. The length depends on how many connectors and data sources you plan to run, whether SSO and data segregation are needed from the first day, how much of your existing threat intelligence must be inventoried, and how many workers and dependencies your sizing requires. Most engagements are fixed-scope, so the scope and timeline are agreed in writing before work starts.
Can our team build an OpenCTI cost model in-house?
Yes, if you have staff who can size the platform and its dependencies, price your hosting, and estimate analyst hours for connectors and governance. Start from the documented minimums for the platform, workers, Elasticsearch or OpenSearch, Redis, RabbitMQ and object storage, then add assumptions for data growth and connector count. From your side, the work needs a feature list, the feeds and sources to bring in, the hosting location, the identity provider, named owners for operations, and access to your backup and retention rules.
Is an OpenCTI LTS license worth the extra cost?
It depends on how much a stable release line is worth to your team compared with frequent updates. LTS releases occur every 6 months and are each supported for one year, with a 6-month overlap between consecutive LTS versions. They require a specific LTS license key, and after a one-month stabilization period they receive only critical bug and security fixes. Weigh that against the staff time you would spend testing non-LTS releases against your connectors and data, and request current LTS terms in writing.
How should we compare OpenCTI partner quotes side by side?
Compare quotes only after each one is built from the same written scope. Check whether each quote separates Enterprise Edition licensing, infrastructure sizing, implementation effort, connector work, data governance, documentation and ongoing support. Confirm who pays for hosting and who operates the platform after handover. Look for stated assumptions about data volume and connector count, and ask what changes the price if those assumptions move. Quotes that leave these items out are hard to compare.
How DeployOpen scopes and supports OpenCTI cost work
DeployOpen works out OpenCTI cost of ownership from a written scope that separates the Community Edition from Enterprise Edition features your team needs, such as SSO and audit logs. The same scope sets out the infrastructure and analyst time that recur after go-live.
How we scope
- Confirm which features need Enterprise Edition, such as SSO configuration, audit logs and organization-based data segregation, before any cost is set.
- Record the infrastructure for the platform, Python workers, RabbitMQ, Redis, Elasticsearch or OpenSearch and S3-compatible storage in your environment.
- Agree in writing which release line you will run, continuous releases or the LTS line, and who owns upgrades and license keys.
How we build
- Size platform nodes, workers and search dependencies from the documented minimums, then adjust to your expected data and connector volume.
- Model recurring costs such as hosting, license renewals, backups and analyst hours for connector review and data curation.
- Test the chosen edition and feature set in a non-production environment that mirrors your identity provider and network controls.
How we hand over
- Deliver a cost model that lists one-time work separately from recurring infrastructure, licensing and support effort.
- Document the component inventory, version pinning, license key handling and the criteria that would trigger an edition change.
- Provide a runbook for upgrades, backups and capacity reviews so your team can maintain the cost basis after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, with scope and fees agreed in writing.
- Review release notes and LTS hotfixes against your connectors and data, and report changes that affect cost or licensing.
- Revisit sizing and edition decisions with your team when data volume, connector count or user numbers change.
